Microsoft Windows Kerberos: Denial of service through out-of-bounds read

Summary

A out-of-bounds read in the Windows Kerberos authentication component allows an authenticated attacker on the network to cause a denial of service. Kerberos is used by Active Directory domain controllers and domain-joined systems, so a crash can disrupt logins across the business. The Microsoft CNA rates the issue with CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the NVD analysis was still pending at the time of writing.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9688)
• Windows 10 Version 1809 (builds before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds before 10.0.26300.9974)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9487)
• Windows Server 2022 (builds before 10.0.20348.5870)

Fixed in

• Install the November 2026 security update for the affected product (fixed builds are the versions listed under affected, per the CVE record).
• Confirm the exact KB number and fixed build on the MSRC page, as the research could not verify the full product list from the primary source.

Workaround

Unknown.

Exploitation

• Microsoft CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
• Rapid7 rates it 'Exploitation Less Likely' and reports no public disclosure.
• Not marked as exploited and not listed in CISA KEV, according to Senserva.
• No public proof of concept or exploit code was found in the research (this does not rule out that one exists).

Our recommendation

• Apply the November 2026 cumulative update to domain controllers and other Kerberos-dependent servers first, then to workstations.
• Verify the fixed build for each product on the MSRC page before rollout.
• Restrict who can reach internal Kerberos services and keep privileged and standard account usage under control, since low privileges are required.
• Monitor domain controllers for crashes or Kerberos service restarts after patching.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-96082 (CVE Program) www.cve.org
• Microsoft Security Update Guide CVE-2026-96082 msrc.microsoft.com
• Senserva KB 5131090 (November 2026 update) senserva.com
• Strix CVE-2026-96082 (third-party, unconfirmed) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:56.